{
  "sources": {
    "cluster_logging_config/test-source": {
      "type": "file",
      "include": [
        "/var/log/kube-audit/audit.log"
      ]
    }
  },
  "transforms": {
    "transform/destination/test-loki-dest/00_parse_json": {
      "drop_on_abort": false,
      "inputs": [
        "transform/source/test-source/01_local_timezone"
      ],
      "source": "if !exists(.parsed_data) {\n    structured, err = parse_json(.message)\n    if err == null {\n        .parsed_data = structured\n    } else {\n        .parsed_data = .message\n    }\n}",
      "type": "remap"
    },
    "transform/source/test-source/00_clean_up": {
      "drop_on_abort": false,
      "inputs": [
        "cluster_logging_config/test-source"
      ],
      "source": "if exists(.pod_labels.\"controller-revision-hash\") {\n    del(.pod_labels.\"controller-revision-hash\")\n}\nif exists(.pod_labels.\"pod-template-hash\") {\n    del(.pod_labels.\"pod-template-hash\")\n}\nif exists(.kubernetes) {\n    del(.kubernetes)\n}\nif exists(.file) {\n    del(.file)\n}\nif exists(.node_labels.\"node.deckhouse.io/group\") {\n\t.node_group = (.node_labels.\"node.deckhouse.io/group\")\n}\ndel(.node_labels)",
      "type": "remap"
    },
    "transform/source/test-source/01_local_timezone": {
      "drop_on_abort": false,
      "inputs": [
        "transform/source/test-source/00_clean_up"
      ],
      "source": "if exists(.\"timestamp\") {\n    ts = parse_timestamp!(.\"timestamp\", format: \"%+\")\n    .\"timestamp\" = format_timestamp!(ts, format: \"%+\", timezone: \"local\")\n}\n\nif exists(.\"timestamp_end\") {\n    ts = parse_timestamp!(.\"timestamp_end\", format: \"%+\")\n    .\"timestamp_end\" = format_timestamp!(ts, format: \"%+\", timezone: \"local\")\n}",
      "type": "remap"
    }
  },
  "sinks": {
    "destination/cluster/test-loki-dest": {
      "type": "loki",
      "inputs": [
        "transform/destination/test-loki-dest/00_parse_json"
      ],
      "healthcheck": {
        "enabled": false
      },
      "buffer": {
        "type": "memory",
        "max_events": 4096,
        "when_full": "drop_newest"
      },
      "encoding": {
        "only_fields": [
          "message"
        ],
        "codec": "text",
        "timestamp_format": "rfc3339"
      },
      "tenant_id": "{{ test }}",
      "endpoint": "http://192.168.1.1:9000",
      "tls": {
        "verify_hostname": true,
        "verify_certificate": true
      },
      "labels": {
        "app": "{{ parsed_data.ap_p[0].a }}",
        "container": "{{ container }}",
        "foo": "bar",
        "host": "{{ host }}",
        "image": "{{ image }}",
        "namespace": "{{ namespace }}",
        "node": "{{ node }}",
        "node_group": "{{ node_group }}",
        "pod": "{{ pod }}",
        "pod_ip": "{{ pod_ip }}",
        "pod_labels_*": "{{ pod_labels }}",
        "pod_owner": "{{ pod_owner }}",
        "stream": "{{ stream }}"
      },
      "remove_label_fields": true,
      "out_of_order_action": "rewrite_timestamp"
    }
  }
}
